[Resolvido] &nbspPáginas abrindo sozinhas

FernaoUbubtu · Outubro 21, 2012

Olá pessoal, sou novo no fórum...Uso habitualmente o mozilla Firefox, derepente páginas abrem sozinhas de proagandas em geral, além do internet explorer...redefini já os dois navegadores e exclui cookies sem sucesso, passei o malwarebits achou alguns problemas e fiz a limpeza e exclusão do que foi encontrado...segue log do hijack se puderem analisar por favor:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 13:03:10, on 21/10/2012

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\E_S00RP1.EXE

C:\ARQUIV~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Arquivos de programas\Java\jre7\bin\jqs.exe

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\ARQUIV~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe

C:\ARQUIV~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe

C:\WINDOWS\system32\HPZipm12.exe

c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

C:\WINDOWS\System32\snmp.exe

C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\SAgent4.exe

C:\WINDOWS\system32\svchost.exe

C:\ARQUIV~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe

C:\Arquivos de programas\TUTO4PC\tuto4pc_br_6.exe

C:\Documents and Settings\PC101\Configurações locais\Dados de aplicativos\tuto4pc_br_6\uptt4pcbr6.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\dllhost.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\Documents and Settings\PC101\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - (no file)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre7\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [ink Monitor] C:\Arquivos de programas\EPSON\Ink Monitor\InkMonitor.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Arquivos de programas\Arquivos comuns\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [startCCC] "C:\Arquivos de programas\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Arquivos de programas\Arquivos comuns\Acronis\Acronis Disk Director\oss_reinstall.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [APSDaemon] "C:\Arquivos de programas\Arquivos comuns\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [Tutorials] "C:\Arquivos de programas\TUTO4PC\tuto4pc_br_6.exe"

O4 - HKLM\..\Run: [uptt4pcbr6.exe] C:\Documents and Settings\PC101\Configurações locais\Dados de aplicativos\tuto4pc_br_6\uptt4pcbr6.exe -runhelper

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Arquivos de programas\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O17 - HKLM\System\CCS\Services\Tcpip\..\{658057F0-E1CA-4AA7-912D-0C0EDECC1B1A}: NameServer = 200.204.0.10,200.204.0.138

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP1.EXE

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\ARQUIV~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Arquivos de programas\Java\jre7\bin\jqs.exe

O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamscheduler.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\ARQUIV~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\ARQUIV~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\SAgent4.exe

--

End of file - 9158 bytes

desde já agradeço!

wings · Outubro 21, 2012

Boa tarde FernaoUbubtu

:seta: Baixe o OTL (...de Old_Timer) e salve-o no Desktop (Área de Trabalho)

*Execute-o.

*Selecione:

Verificar All Users

Ignorar Arquivos Microsoft

Verificar Lop

Verificar Purity

*Cole as linhas, em marrom, no espaço abaixo de Exames Personalizados/Correções

%APPDATA%\*

%APPDATA%\*.*

%SystemDrive%\*.*

%USERPROFILE%\*

%USERPROFILE%\*.*

regedit /e c:\registrybackup.reg /c

netsvcs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes

*Clique [Verificar]

*Ao término, os relatórios OTL.txt e Extras.txt serão criados no Desktop (Área de Trabalho)

:veja: Acesse este link

*Clique [selecionar arquivo]

*Localize o arquivo OTL.txt no Desktop (Área de Trabalho) e clique [Abrir]

*Clique [Envoyer le fichier]

*Cole o link criado abaixo de Fichier envoyé avec succés! Copiez votre lien :

*Repita o procedimento para o relatório Extras.txt e cole o link

FernaoUbubtu · Outubro 21, 2012

Segue os links pedidos:

http://mydoc.tk/3/5752OTL.Txt

http://mydoc.tk/3/5748Extras.Txt

wings · Outubro 21, 2012

:seta: Baixe o AdwCleaner (...de Xplode) e salve-o no Desktop (Área de Trabalho)

*Execute-o. Usuários do Windows Vista ou do Windows 7 devem clicar com o botão direito do mouse no arquivo e selecionar Executar como administrador

*Clique [Delete]

*Cole o relatório apresentado

*Desative temporariamente seu antivírus

:seta: Baixe o ComboFix (...de sUBs) e salve-o no Desktop (Área de Trabalho)

*Execute-o.

*Se o Console de Recuperação do Microsoft Windows não estiver instalado, aceite a sua instalação. Após a instalação do Console, clique [sim].

*Aceite o contrato

*Aguarde a extração dos arquivos

*Aguarde a conclusão das etapas...pode demorar!

*Evite usar o mouse e o teclado. Não use nenhum outro programa até que o ComboFix termine![/b]

*Aguarde o término e cole o relatório apresentado

FernaoUbubtu · Outubro 22, 2012

Desculpe a demora...o adwcleaner foi normal, o combo fix acusou que estava infectado com o zero access, não é possível, tive um problema com este rootkit a um tempo atrás, demorou para excutar o mesmo, quando chegou na parte do relatório ficou mais de três horas na mesma tela " Preparando o relatório " e não gerou o mesmo...então estou mandando apenas o do primeiro programa segue abaixo:

# AdwCleaner v2.005 - Logfile created 10/22/2012 at 18:14:22

# Updated 14/10/2012 by Xplode

# Operating system : Microsoft Windows XP Service Pack 2 (32 bits)

# User : PC101 - PC100

# Boot Mode : Normal

# Running from : C:\Documents and Settings\PC101\Desktop\AdwCleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

Folder Found : C:\Arquivos de programas\Tuto4pc

Folder Found : C:\Documents and Settings\All Users\Menu Iniciar\Programas\Tuto4pc

***** [Registry] *****

Key Found : HKCU\Software\BrowserMngr

Key Found : HKCU\Software\DataMngr_Toolbar

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Found : HKCU\Software\Tutorials

Key Found : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{E55E7026-EF2A-4A17-AAA7-DB98EA3FD1B1}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E55E7026-EF2A-4A17-AAA7-DB98EA3FD1B1}

Key Found : HKU\S-1-5-21-1644491937-573735546-839522115-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Tutorials]

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Opera v11.64.1403.0

File : C:\Documents and Settings\PC101\Dados de aplicativos\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [2659 octets] - [28/07/2012 00:32:33]

AdwCleaner[R1].txt - [5902 octets] - [17/09/2012 21:09:15]

AdwCleaner[s2].txt - [6479 octets] - [17/09/2012 21:09:53]

AdwCleaner[R2].txt - [1967 octets] - [22/10/2012 18:14:22]

########## EOF - C:\AdwCleaner[R2].txt - [2027 octets] ##########

desde já agradeço!

wings · Outubro 22, 2012

:seta: Leia com atenção o procedimento do AdwCleaner.

*Eu solicitei [Delete] e não [search]

:seta: Execute o OTL.

*Clique [Nenhum]

*Cole as linhas, em marrom, no espaço abaixo de Exames Personalizados/Correções

/md5start

services.exe

/md5stop

*Clique [Verificar]

*Cole o relatório apresentado

FernaoUbubtu · Outubro 22, 2012

desculpe pela falha...segue relatórios:

# AdwCleaner v2.005 - Logfile created 10/22/2012 at 20:52:29

# Updated 14/10/2012 by Xplode

# Operating system : Microsoft Windows XP Service Pack 2 (32 bits)

# User : PC101 - PC100

# Boot Mode : Normal

# Running from : C:\Documents and Settings\PC101\Desktop\AdwCleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Arquivos de programas\Tuto4pc

Folder Deleted : C:\Documents and Settings\All Users\Menu Iniciar\Programas\Tuto4pc

***** [Registry] *****

Key Deleted : HKCU\Software\BrowserMngr

Key Deleted : HKCU\Software\DataMngr_Toolbar

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Deleted : HKCU\Software\Tutorials

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{E55E7026-EF2A-4A17-AAA7-DB98EA3FD1B1}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E55E7026-EF2A-4A17-AAA7-DB98EA3FD1B1}

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Tutorials]

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Opera v11.64.1403.0

File : C:\Documents and Settings\PC101\Dados de aplicativos\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [2659 octets] - [28/07/2012 00:32:33]

AdwCleaner[R1].txt - [5902 octets] - [17/09/2012 21:09:15]

AdwCleaner[s2].txt - [6479 octets] - [17/09/2012 21:09:53]

AdwCleaner[R2].txt - [2096 octets] - [22/10/2012 18:14:22]

AdwCleaner[s3].txt - [1900 octets] - [22/10/2012 20:52:29]

########## EOF - C:\AdwCleaner[s3].txt - [1960 octets] ##########

otl:

OTL logfile created on: 22/10/2012 20:57:53 - Run 2

OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\PC101\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: d/M/yyyy

2,00 Gb Total Physical Memory | 1,36 Gb Available Physical Memory | 68,22% Memory free

3,85 Gb Paging File | 3,37 Gb Available in Paging File | 87,56% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Arquivos de programas

Drive C: | 48,83 Gb Total Space | 4,51 Gb Free Space | 9,24% Space Free | Partition Type: NTFS

Drive D: | 39,06 Gb Total Space | 11,46 Gb Free Space | 29,33% Space Free | Partition Type: NTFS

Drive E: | 9,77 Gb Total Space | 1,06 Gb Free Space | 10,81% Space Free | Partition Type: NTFS

Drive F: | 9,77 Gb Total Space | 0,74 Gb Free Space | 7,61% Space Free | Partition Type: NTFS

Drive G: | 48,83 Gb Total Space | 31,39 Gb Free Space | 64,28% Space Free | Partition Type: NTFS

Drive H: | 68,36 Gb Total Space | 2,99 Gb Free Space | 4,38% Space Free | Partition Type: NTFS

Drive I: | 19,53 Gb Total Space | 13,88 Gb Free Space | 71,06% Space Free | Partition Type: NTFS

Drive J: | 97,65 Gb Total Space | 32,69 Gb Free Space | 33,48% Space Free | Partition Type: NTFS

Drive K: | 26,31 Gb Total Space | 9,05 Gb Free Space | 34,42% Space Free | Partition Type: NTFS

Drive L: | 2,38 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive M: | 6,08 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Unable to calculate disk information.

Drive O: | 298,08 Gb Total Space | 221,75 Gb Free Space | 74,39% Space Free | Partition Type: NTFS

Drive P: | 97,65 Gb Total Space | 57,00 Gb Free Space | 58,36% Space Free | Partition Type: NTFS

Computer Name: PC100 | User Name: PC101 | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========

< MD5 for: SERVICES.EXE >

[2009/02/09 09:17:04 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=38867483E0CB504BB8F277E05729881E -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe

[2009/02/09 08:08:21 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=96D7D86D3AA68A57BBE835441DC23107 -- C:\WINDOWS\ERDNT\cache\services.exe

[2009/02/09 08:08:21 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=96D7D86D3AA68A57BBE835441DC23107 -- C:\WINDOWS\system32\dllcache\services.exe

[2009/02/09 08:08:21 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=96D7D86D3AA68A57BBE835441DC23107 -- C:\WINDOWS\system32\services.exe

[2009/02/09 09:25:05 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=C52DEB6D8CD4B096BF1A9EC001F36507 -- C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe

[2004/08/04 01:45:42 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=CC73C4430C2FC27FDE16A0A4E3678148 -- C:\WINDOWS\$NtUninstallKB956572$\services.exe

[2009/06/27 12:45:12 | 000,593,920 | ---- | M] (Auto-Update) MD5=DA9276C6C5702AED5E574291065FB985 -- C:\Arquivos de programas\GTS DIGITAL\GTS Studio Recorder Pro\services.exe

[2009/02/09 07:53:30 | 000,111,104 | ---- | M] (Microsoft Corporation) MD5=E64296F1D45C776FAC6EE8F89EF3C303 -- C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe

[2008/04/14 00:21:17 | 000,109,056 | ---- | M] (Microsoft Corporation) MD5=EE7999BAACA84CFAA03726E677EE2A33 -- C:\WINDOWS\SoftwareDistribution\Download\f7670e43b3c19680acdc044a1fbe993f\services.exe

< End of report >

wings · Outubro 22, 2012

:seta: Execute o OTL

*Cole as linhas em azul no espaço abaixo de Exames Personalizados/Correções

:Files

C:\WINDOWS\$NtUninstallKB48594$

ipconfig /flushdns /c

:Commands

[emptytemp]

*Clique [Consertar]

*Clique [OK] para reiniciar o PC

*Cole o relatório apresentado

FernaoUbubtu · Outubro 22, 2012

Segue último relatório:

All processes killed

========== FILES ==========

C:\WINDOWS\$NtUninstallKB48594$\4089950698\U folder moved successfully.

C:\WINDOWS\$NtUninstallKB48594$\4089950698\L folder moved successfully.

C:\WINDOWS\$NtUninstallKB48594$\4089950698 folder moved successfully.

C:\WINDOWS\$NtUninstallKB48594$ folder moved successfully.

< ipconfig /flushdns /c >

Configuração de IP do Windows

Liberação do cache do DNS Resolver bem-sucedida.

C:\Documents and Settings\PC101\Desktop\cmd.bat deleted successfully.

C:\Documents and Settings\PC101\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User